So I added two vectors. The first is “Meta using data: URL scheme.” which uses a data: protocol to base 64 encode a JavaScript page. The second is “Remote style sheet part 4″ which binds a remote XUL file to Gecko rendering engines which can contain JavaScript.

This entry was posted on Thursday, January 1st, 1970 at 12:00 am and is filed under XSS, Webappsec. You can leave a response as well.